1. Technical Field
The present disclosure generally relates to access control for security administration and, more particularly, to systems and methods for providing access control to computer network-based and web-based services.
2. Related Art
One of the most important challenges for providing services on large networks such as the Internet is administration of security for access to those services, which can include merchant services and financial transactions and involve different levels of access to various types of information for different users.
A number of different types of access controls have arisen out of these challenges. Two of these are Discretionary Access Controls (DAC) and Mandatory Access Controls (MAC). DAC is an access control system that permits system users to allow or disallow other users access to objects (e.g., information, application programs, devices) under their control. According to one definition, DAC includes controls that are discretionary in the sense that a subject (e.g., system user) with a certain access permission is capable of passing that permission (perhaps indirectly) on to any other subject (unless restrained by mandatory access control). MAC, according to one definition, provides a means of restricting access to objects based on the sensitivity (as represented by a label) of the information contained in the objects and the formal authorization (i.e. clearance) of subjects to access information of such sensitivity. In general, MAC is more centrally administered than DAC, e.g., access policy is determined by the system and usually not by individual users (e.g., an “owner” of the information as could occur with DAC). With MAC, security administration can be costly and prone to error because administrators usually specify access control lists for each user on the system individually.
A more recent development is Role Based Access Control (RBAC) in which, like MAC, access policy is determined more by the system, than by the “owner” (e.g., access is not discretionary based on existing permissions). A subject (e.g., system user) is assigned one or more roles and authorization is based on each resource and action in the system requiring membership in a particular role in order to proceed. With RBAC, security may be managed at a level that corresponds closely to the organization's structure. Each user is assigned one or more roles, and each role is assigned one or more privileges that are permitted to users in that role. Security administration with RBAC includes determining the operations that must be executed by persons in particular jobs, and assigning users to the proper roles.
Another example is Attribute Based Access Control (ABAC) in which access is granted based on attributes of the subject (e.g., the user), the resource (e.g., object) being accessed, the action the user wants to perform on or with the resource, and the environment. For example, the user's name and password, the privacy aspects of the object (e.g., account information), whether read or write access is sought, and type of encryption being used may be values of attributes that can affect whether an access is granted or denied under ABAC.